Archive2

Store and forward and bandwidth contraints

Engager

In a geographically dispersed deployment of Splunk, where some links are bandwidth constrained, there is need to limit the bandwidth utilized by Spunk to forward events.

In this regard, are there ways to:

1) Limit the bandwidth of a forwarder to a specific value?

2) Configure the forwarder to store events locally from say 9am to 4pm (the peak business hours) and forward outside those hours?

Based on documentation I understand LWF is constrained to 256 kbps. Is this configurable and can the same be done for regular forwarders?

Tags (1)
1 Solution

Splunk Employee
Splunk Employee
  • Yes, you can limit any type of forwarder by setting/overriding the [thruput]maxKBps setting in limits.conf.
  • No, it can not store and forward in general. Depending how your data is written, maybe you can shut down the forwarder during certain times, and allow the logs to accumulate in a file. Alternatively, you could script creation and deletion of symbolic links to monitored files that are run at certain times. This really only works for data that is in identifiable files, and may cause other problems.

View solution in original post

Splunk Employee
Splunk Employee
  • Yes, you can limit any type of forwarder by setting/overriding the [thruput]maxKBps setting in limits.conf.
  • No, it can not store and forward in general. Depending how your data is written, maybe you can shut down the forwarder during certain times, and allow the logs to accumulate in a file. Alternatively, you could script creation and deletion of symbolic links to monitored files that are run at certain times. This really only works for data that is in identifiable files, and may cause other problems.

View solution in original post

Contributor

Its possible on LWF, not sure if its works on normal FW's, I asked this question as well in a tech session and it should work as well on FW;s but didnt tried it....

copy SPLUNK_HOME/etc/apps/SplunkLightForwarder/default/limits.conf to SPLUNK_HOME/etc/apps/SplunkLightForwarder/local

and change the settings in

limits.conf

I dont know if you can jobbing the event store question,,,,doubt it but looks meanfulll for me as well!

0 Karma
Reply

Splunk Employee
Splunk Employee

The bandwidth/thruput limits can be applied all types of forwarders.

0 Karma
Reply
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!